Add access limiting

As part of the finders work, we need to be able to limit read-access to attachments prior to publication. This will be done on a per-organisation basis.

To do this, we've added two fields to assets: `organisation_slug` and `access_limited`.

The intention is that the asset-manager application will be proxied via two different nginx vhosts:

`asset-manager.*`

and

`private-asset-manager.*`

All requests via the `private-asset-manager` vhost would require authentication via SSO.

All requests via `asset-manager` would not be authenticated, any requests via `asset-manager` for access limited assets would 404.

The actual switching is done by the backend app comparing the hostname to one provided in an environment variable.

Signon PDF redirect successfully tested on Chrome, Firefox, IE8, and IE6.